hyperliquiddex[.]xyz

Analysis of hyperliquiddex.xyz indicates that the domain is currently active and classified as a generic phishing threat with an elevated risk rating. The domain was registered on July 11, 2025 through the registrar Cosmotown Inc and is served by Cloudflare nameservers ophelia.ns.cloudflare.com and yew.ns.cloudflare.com. DNS resolution points to the IP address 188.114.96.3, which is hosted on the Cloudflare network. Reputation services show mixed signals: the domain appears on one security blocklist and is actively blocked by the PhishDestroy filtering service.

VirusTotal has recorded seven detections out of ninety‑one submitted security vendors, confirming that multiple scanners have identified malicious characteristics. No additional public reputation scores, SSL certificate details, HTTP response codes, or page‑title information are available at this time, leaving the exact content and lure technique unverified. The limited visibility suggests that the infrastructure is deliberately obscured, relying on reputable hosting to blend with legitimate traffic.

Defenders should prioritize adding hyperliquiddex.xyz to blocklists across perimeter firewalls, DNS filtering, and email security gateways. Continuous monitoring of the associated IP address and Cloudflare nameservers is advised, as any change in resolution may indicate a shift in hosting or the deployment of new malicious payloads. Security teams should also query VirusTotal and other multi‑engine scanners on a regular basis to capture any increase in detection counts, and consider sharing observed indicators of compromise with threat‑intelligence sharing platforms to improve collective defence.